System failed to acquire a signed certificate from the cPanel Store

[maverickws]

I've been having an issue for a while where a cPanel DNS-Only instance fails the checkallsslcerts script every day.

The system failed to acquire a signed certificate from the cPanel Store because of the following error: The system failed to acquire a signed certificate from the cPanel Store. ({"domain_details":null,"status":"revoked","status_details":null,"status_message":"Stale CSR"})

Searching around I stumbled on this thread: Hostname SSL issue Null Stale CSR on ubuntu

My system is AlmaLinux, ran

mv /var/cpanel/hostname_cert_csrs{,.cpbkp} -v

Ran the suggested command and re-ran the check ssl script

The system failed to acquire a signed certificate from the cPanel Store because of the following error: (XID zgehgc) The cPanel Store returned an error (X::Item::NotFound) in response to the request “GET ssl/certificate/free/2255251579”: Generic exception

 

[maverickws]

Is there anyone here capable of helping? Thanks.

 

[cPRex]

Hey there! Are you still seeing this error today if you manually run /usr/local/cpanel/bin/checkallsslcerts?

 

[maverickws]

Hey there! Are you still seeing this error today if you manually run /usr/local/cpanel/bin/checkallsslcerts?

Hi there and sorry for the late reply.

If I run manually today I get:

# /usr/local/cpanel/bin/checkallsslcerts
The system will check for the certificate for the “cpanel” service.
The system will attempt to replace the self-signed certificate for the “cpanel” service with a signed certificate from the cPanel Store.
The system will attempt to install a certificate for the “cpanel” service from the system ssl storage.
None of the certificates in the system ssl storage were acceptable to use for the “cpanel” service.
The system will attempt to install a certificate for the “cpanel” service from the cPanel store.
The system will check for the certificate for the “exim” service.
The system will attempt to replace the self-signed certificate for the “exim” service with a signed certificate from the cPanel Store.
The system will attempt to install a certificate for the “exim” service from the system ssl storage.
None of the certificates in the system ssl storage were acceptable to use for the “exim” service.
The cPanel Store is processing the hostname certificate request.
The system will check the cPanel Store again the next time that “/usr/local/cpanel/bin/checkallsslcerts” runs.

Always the same message.

 

[cPRex]

That does seem to be better than the "Generic exception" error you were getting earlier, as this run showed that it connected to the store and got the request submitted. I would say if you don't see the SSL working on the system within an hour, it would be best to submit a ticket to our team so we can check that.

 

[maverickws]

Last night I got the same error via email

The system failed to acquire a signed certificate from the cPanel Store because of the following error: The system failed to acquire a signed certificate from the cPanel Store. ({"domain_details":null,"status":"revoked","status_details":null,"status_message":"Stale CSR"})

Will report via ticket then thanks

 

[cPRex]

Let me know the ticket number when you can!

 

[maverickws]

Hi @cPRex thank you for your feedback and following up on this. Was away from here the last few days.
Opened ticket 94549304 about this issue. Thank you

 

[cPRex]

Thanks for that - I'm following along with this ticket on my end now.

 

[maverickws]

Alright so a solution has been found.

So since it is a DNS-Only installation we had port 80 blocked on the firewall.

This article:

https://support.cpanel.net/hc/en-us/articles/360053968633-What-IP-addresses-do-Sectigo-DCV-requests-originate-from

Has the IP's needed to whitelist in order to get certification going.

Thanks!

 

[cPRex]

Ah, that would make sense - I'm glad we could help track that down with you!